Problem
-------
Current impl is relaxed about comparing non-release Scala 2.x versions.
Solutution
----------
Use scalaApiVersion to compare two Scala 2 versions.
Ref https://github.com/sbt/sbt/issues/6912
Problem
-------
There's apparently a security issue with OkHttp 3.x,
which I am not really sure how applicable it is to our usage
of OkHttp but it is there.
Solution
--------
Since most of OkHttp-specic usage within LM is for Apache Ivy
downloading, I am going to drop this.
Since `sbt.librarymanagement.Http.http` is a public API,
I am substituting this with Apache HTTP backed implementation.
Rather than seeing an error like this, with the evicted version numbers
being repeated many times:
```
[error] * org.scala-lang.modules:scala-java8-compat_2.13:1.0.0 (early-semver) is selected over {0.9.0, 0.9.0, 0.9.0, 0.9.0, 0.9.1, 0.9.1, 0.9.1}
```
...I'd much rather see an error like this:
```
[error] * org.scala-lang.modules:scala-java8-compat_2.13:1.0.0 (early-semver) is selected over {0.9.0, 0.9.1}
```
Fixes https://github.com/sbt/sbt/issues/6578
Problem
-------
The regex currently expects two segments like2.x or 3.x,
but Scala 3 uses _3 as the cross suffix, and it's not caught.
Solution
--------
Change the regex.
Ref #377
Apply the dotted-prerelease tag to SemComparator
"A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the patch version."
What is the problem?
sbt/sbt#6496 identifies a bug in the logic which assesses whether
different versions of the same transitive dependency are binary
compatible. If one of the transitive dependencies included a version
with a full-stop literal, it would be parsed incorrectly and an error
would be thrown to the user falsely saying that the dependencies are
binary incompatible.
What is the solution?
This PR fixes the regex used by the parser to include full-stop literals.
Is there anything else to be done?
It is worth us checking the rest of the codebase in case this bug might
exist in other parsers. The tests are super helpful for figuring out
which strings might break the current logic.
Ref https://eed3si9n.com/enforcing-semver-with-sbt-strict-update
This adds EvictionError, a replacement for EvictionWarning.
The problem with the current eviction warning is that it has too many
false positives. Using the versionScheme information that could be
supplied by the library authors and/or the build users, this eliminates
the guessing work. At which point, we can fail the resolution.
Kunal
Matthew de Detrich
eugene yokota
xuwei-k
Adriaan Moors
Nicolas Rinaudo
Matthew de Detrich
Arman Bilge
Rui Gonçalves
Peter Janssen
Roberto Tyley
Adrien Piquerez
Matthias Kurz
Amina Adewusi
João Ferreira